Attribute Macro redbpf_macros::stream_parser

#[stream_parser]

Attribute macro for defining BPF programs of stream parsers. A sockmap can be attached to the stream parser. The role of stream parsers is to find a message boundary of TCP stream and return the length of a message. If it returns proper length of a message then a stream verdict BPF program will be called.

Example

use core::ptr;
use memoffset::offset_of;
use redbpf_probes::sockmap::prelude::*;

#[stream_parser]
fn parse_message_boundary(skb: SkBuff) -> StreamParserResult {
    let len: u32 = unsafe {
        let addr = (skb.skb as usize + offset_of!(__sk_buff, len)) as *const u32;
        ptr::read(addr)
    };
    Ok(StreamParserAction::MessageLength(len))
}